SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cryptsetup-tokens: Print tpm2-primary-alg: only when it is known

Browse Source 
When 'tpm2-primary-alg' is missing in LUKS JSON token, the output of
'cryptsetup luksDump' is always:

	tpm2-primary-alg: ecc

because tpm2_parse_luks2_json() returns the default (TPM2_ALG_ECC). This can be
misleading and wrong. Make tpm2_parse_luks2_json() return the reality and move
the default to tpm2_unseal().
This commit is contained in:
Vitaly Kuznetsov
2026-02-27 14:22:22 +01:00
parent 295affa3f7
commit 4883ef8aae
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
+2 -1
View File
@@ -230,7 +230,8 @@ _public_ void cryptsetup_token_dump(
crypt_log(cd, "\ttpm2-pcr-bank: %s\n", strna(tpm2_hash_alg_to_string(pcr_bank)));
crypt_log(cd, "\ttpm2-pubkey:" CRYPT_DUMP_LINE_SEP "%s\n", pubkey_str);
crypt_log(cd, "\ttpm2-pubkey-pcrs: %s\n", strna(pubkey_pcrs_str));
crypt_log(cd, "\ttpm2-primary-alg: %s\n", strna(tpm2_asym_alg_to_string(primary_alg)));
if (primary_alg != 0)
crypt_log(cd, "\ttpm2-primary-alg: %s\n", strna(tpm2_asym_alg_to_string(primary_alg)));
crypt_log(cd, "\ttpm2-pin: %s\n", true_false(flags & TPM2_FLAGS_USE_PIN));
crypt_log(cd, "\ttpm2-pcrlock: %s\n", true_false(flags & TPM2_FLAGS_USE_PCRLOCK));
crypt_log(cd, "\ttpm2-salt: %s\n", true_false(iovec_is_set(&salt)));
src/shared/tpm2-util.c
+3 -2
View File
@@ -5625,8 +5625,9 @@ int tpm2_unseal(Tpm2Context *c,
if (r < 0)
return r;
if (r == 0) {
/* ECC was the only supported algorithm in systemd < 250, use that as implied default, for compatibility */
if (primary_alg == 0)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "No SRK or primary algorithm provided.");
primary_alg = TPM2_ALG_ECC;
TPM2B_PUBLIC template = {
.size = sizeof(TPMT_PUBLIC),
@@ -8589,7 +8590,7 @@ int tpm2_parse_luks2_json(
_cleanup_(iovec_done) struct iovec pubkey = {}, salt = {}, srk = {}, pcrlock_nv = {};
uint32_t hash_pcr_mask = 0, pubkey_pcr_mask = 0;
uint16_t primary_alg = TPM2_ALG_ECC; /* ECC was the only supported algorithm in systemd < 250, use that as implied default, for compatibility */
uint16_t primary_alg = 0;
uint16_t pcr_bank = UINT16_MAX; /* default: pick automatically */
int r, keyslot = -1;
TPM2Flags flags = 0;